klima[.]app-airdropalert[.]lat

klima.app-airdropalert.lat was observed as an offline domain that mimics Google. The site’s page title is “Google”, indicating an attempt to appear legitimate. Registration information shows the domain was created on November 10, 2025 through Dynadot LLC. DNS resolution points to IP address 142.251.167.147, which belongs to AS15169 Google LLC and is located in the United States. The use of a Google‑owned IP range is a common tactic to increase perceived trustworthiness. The domain is served by Cloudflare nameservers brenna.ns.cloudflare.com and hassan.ns.cloudflare.com, but no SSL certificate is present, and HTTP requests return no active service, consistent with the “taken offline” status reported.

Threat intelligence flags the domain as a crypto‑scam that impersonates Google. VirusTotal analysis recorded 13 detections out of 95 scanning engines, confirming that multiple security vendors consider the domain malicious. It appears on a single security blocklist and is specifically listed by PhishDestroy, reinforcing its classification as a brand‑impersonation threat. No Safe Browsing or OTX entries are available in the supplied data. Evidence indicates that the primary malicious component is the domain’s branding rather than a functional payload, as the site is currently offline.

Defenders should continue to block the domain at network perimeter devices, update URL filtering and DNS sinkhole lists, and monitor for any future re‑activation. Because the domain resolves to a legitimate Google IP, additional scrutiny of DNS queries that resolve to Google ranges should be applied, especially when associated with the known registrar Dynadot or the Cloudflare name servers listed. Organizations using Google services should educate users about the risk of domains that claim to be Google but lack TLS, have recent creation dates, and are flagged by multiple vendors. Ongoing observation of the domain’s status and any changes in hosting or SSL deployment is recommended.